Can guests use our Copilot agents?

You’re not imagining the contradiction: SharePoint access and Copilot agent access are different doors. Guests walking through the first does not unlock the second.

Here’s what’s happening. Microsoft Learn’s Copilot setup guidance is explicit: it is not supported to assign Copilot licences to cross-tenant users, including guests. SharePoint agents are reached by users with a Microsoft Copilot licence, or — where you’ve configured it — via pay-as-you-go billing policies scoped with security groups. Site permission alone never substitutes for that licence or metering path. Community Q&A matches the same pattern: guests can read the library and still see a “no licence” wall on the agent. A narrower exception exists for multitenant organisations (MTO) and B2B members with Copilot licensed in their home tenant and Teams admin policy allowing Copilot for B2B members — that is deeper partner integration, not ordinary guest invites.

This is First Law for identity: don’t pour contractor access into a guest model unless you can see how Copilot rights come back out — member account, home-tenant licence, or a deliberately metered path. 12 Panes puts Licence and Security in Steady before “just add guests to the agent.”

Practical options:

1. Member accounts for agent users. Create (or convert) contractor identities as members in your tenant, assign eligible base + Copilot add-on where justified, Conditional Access and lifecycle dates attached. Clearest path when they must use your SharePoint-grounded agent.
2. Home-tenant Copilot + MTO / B2B member pattern (where you truly have MTO). Partner keeps the Copilot licence; you configure cross-tenant access and Teams “Allow Copilot for B2B members.” Only for trusted org-to-org setups — not random guest links.
3. Don’t put guests on tenant-grounded agents. Give them the SharePoint pages/docs they need; keep Copilot agents for employees. Politically simple; often the Steady answer for short engagements.
4. Assume PAYGO security groups magically include any guest. Metering helps eligible non-add-on users in your tenant; it does not overturn the guest / cross-tenant licence restriction. Verify against current Learn before promising Finance a cheaper guest path.

The caution: SKUs, agent access, and MTO controls move. Re-check Set up Microsoft Copilot and assign licenses, Manage access to agents in SharePoint, and your licence diagnostics before you brief Procurement. External sharing still amplifies whatever the agent can see — fix overshare debt before you widen the audience.

I’d suggest one rule for makers and Security: if the person is a guest, assume Copilot agents are out of scope until Identity and Licence design a member or MTO path. SharePoint for contractors; Copilot for people you can licence cleanly.

You’re asking the right question — Steady before external scale beats a surprising “no licence” in week two.

DIGITAL SKILL WORKS LTD / 12 PANES · You ask, we answer